Normally, research projects need the approval of the Regional Committees for Medical and Health Research Ethics (REC), the Norwegian Centre for Research Data (NSD) or the Norwegian Data Protection Authority.
- Are the data anonymised?
- Cases of doubt
- What is the approval body for your research project?
- Read more about data protection
- Routine
Are the data anonymised?
The first question it is important to ask is whether you are going to use anonymised data or not. Anonymised data are information that cannot be used to identify individuals in the data material, neither directly through names, personal ID numbers or other unique characteristics or indirectly via background variables, nor through a list of names / connection key or encryption formula or code. You must be aware of the fact that the information in itself may be enough to identify the individual participant. The personal data will in such case not be deemed to be adequately anonymised.
You must also note that a compilation of various databases can de-anonymise personal data in such a way that the research participants can be identified.
If the data is totally anonymised, you do not have to apply to an external body.
Nettskjema (uio.no) can be used if you like the survey to be anonymious. Check website for action to ensure anonymity (in Norwegian only) and website about electronic track (in Norwegian only).
You can read about how you can conduct projects without registering personal data on NSD's website.
Informasjon and brochure on NSD`s website (in Norwegian only).
Cases of doubt
There can be cases of doubt in which it is uncertain whether research data has been adequately anonymised or not, e.g. in the case of small samples, in, for example, research on a diagnosis that few people in Norway have or a research project with few research participants within a limited geographical area. In cases of doubt you should check with the data protection official (NSD). NSD also has an informal obligation to notify test that you can try.
What is the approval body for your research project?
The objective determines where you must apply for approval
If you are going to use data that have not been adequately anonymised in your research project, you must consider what external bodies you must apply for approval from. The objective of the research and the type of data to be used in the research project is decisive for your choice.
Objective 1 - You must apply for approval from NSD when:
Research with an objective other than to generate new knowledge about illness and health can be covered by both the Personal Data Act and the Personal Health Data Filing System Act.
- Social science objectives.
- Quality assurance, defined as projects, surveys, evaluations etc. whose objective is to ensure that diagnostics and treatment actually produce the intended results.
- The establishment of health registers, defined as registers, lists etc. in which health data is stored systematically (listed) so that information about individuals can be retrieved, cf. Section 2 (6) of the Personal Health Data Filing System Act. Health registers can be paper-based or electronic. For example, registers such as records systems in the health service can be used or created for research purposes, see Section 2 (2) of the Health Research Act.
- The collection of health data with an objective other than to generate new knowledge about health and illness, see Section 2 (1) and 4 d) of the Health Research Act.
- See Examples of activities that do not require approval from REC on REC's website.
More information how to notify NSD.
List of definitions of the terms in the table.
| Type of project | Approval authority | Legislation | Advisory body |
| Non-sensitive personal data – manual processing | Not subject to approval | ||
| Non-sensitive personal data (under 5,000 objects) – electronic processing | NSD | Pol. §§ 2 nr. 1 and 31 (1) a) and Pol. Regulations § 7-27 (1) | NSD |
| Non-sensitive personal data (over 5,000 objects and long duration) – electronic processing | The Norwegian Data Protection Authority | Pol. §§ 2.nr. 1 and 31 (1) a) and Pol. Regulations § 7-27 (2) | NSD |
| Sensitive personal data – manual systematisation, by name/date of birth | NSD | Pol. §§ 2 nr. 8 and 31 (1) b) | NSD |
| Sensitive personal data (under 5,000 objects) – electronic processing | NSD | Pol. §§ 2 nr. 8 an 33 and Pol. Regulations § 7-27 (1) | NSD |
| Sensitive personal data (over 5,000 objects and long duration) – electronic processing | The Norwegian Data Protection Authority | Pol. §§ 2.nr. 8 and 33 and Pol. Regulations § 7-27 (2) | NSD |
Objective 2 - You Du skal apply for approval from REC when:
- 'Activity conducted using scientific methods to generate new knowledge about health and illness', see Section 4 a) of the Health Research Act.
- Establishment of health registers as part of a concrete medical and health-related research project.
- Se Examples of activities that require approval from REC on REC's website.
More information how to apply to REC.
| Type of project | Approval authority | Legislation | Advisory body |
| Medical and health research | REC | The Health Research Act § 2 (1) | REC |
| Research on human subjects | REC | The Health Research Act § 2 (1) | REC |
| Natural health remedies or other substances consumed by people | REC, State Medicine Agency | The Health Research Act § 2 (3) and the Medicines Act § 3 with Regulations | State Medicines Agency |
| Research in which medical equipment is used on people | REC, Directorate of Health | The Health Research Act § 2 (3)and the Medical equipment Act with Regulations | Directorate of Health |
| Research on human biological material | REC | The Health Research Act § 2 (1) and 4 b) | REC |
| Research that entails collecting health data | REC | The Health Research Act § 2 (1) and 4 d), and the Healthcare Act § 21 | REC |
Read more about data protection
- The Norwegian National Research Ethics Committees
- Information security and personal data protection
- Guide to the Health Reserach Act (in Norwegian only)
- Code of Conduct for Information Security - the healthcare and care services sector (in Norwegian only)
- Guide for personal data protection and information security in research projects in the health and care services sector (in Norwegian only)
Routine
Procedures for notification to NSD is located on web group for research advisors at faculty/center.